Tracking every MCP security paper, panic, and patch

What it does This repository is a curated awesome-list that corrals research papers, vulnerability write-ups, videos, and official specification notes about Model Context Protocol (MCP) security. It serves as a centralized index for a protocol whose threat model is still being written, covering everything from ANSI terminal deception to remote code execution in popular servers.

The interesting bit The list captures a protocol in the awkward adolescent phase of its security lifecycle: the official auth specification is actively being rewritten, and the entries read like a live incident feed. Its value is timing—aggregating real-world exploits like the Anthropic Slack server data exfiltration and the mcp-remote RCE alongside academic papers before they disappear into the arXiv void.

Key highlights

• Aggregates official MCP security considerations from the 2025-03-26 specification, including mandatory input validation and human-in-the-loop requirements.
• Links to seven recent academic papers systematically analyzing MCP attack vectors, tool poisoning, and enterprise mitigation strategies.
• Catalogs practical vulnerability reports, including exploits against Cursor, GitHub MCP, WhatsApp MCP, and the Neon official remote server.
• Collects tooling and code repositories aimed at securing or auditing MCP implementations.
• Tracks the ongoing replacement of the current MCP authorization specification via GitHub pull requests and community RFCs.

Caveats

• It is a reading list, not a security framework; you will find links and guidance, not patches or scanners.
• The README explicitly notes that the official MCP auth specification is currently in flux and may change significantly.

Verdict Worth bookmarking if you are building or auditing MCP servers and need to stay ahead of the vulnerability curve. Skip it if you are looking for a drop-in security tool or a finished standard.